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Attached is the final report summarizing the results of the Office of Integrity and Oversight's- 
(OIO) audit of Internal Controls over .Undelivered Mail and Address Change* Processes at the 
Office of Tax and Revenue (OTR). : 

Our report contains eleven recommendations for necessary actions to correct the described , 
deficiencies. We received a response to the draft report from the Deputy Chief Financial Officer 
(CFO) of OTR on December 15, 2011. The Deputy' CFO's comments set forth planned 
corrective actions that should be responsive to the recommendations. The full text of DCLB's 
response is included at Exhibit 2. 



We appreciate the coope ration and 
questionyjlgn^ontact 
at(202)|HH( 




ies extended to our staff during the au, 
f Director of Internal Audit, at (202) 



tudi^t^oi; 



u have 



or me 



cc: Natw arM. Gandhi, Chief Financial Officer, Government of the District of Columbia 
Chief of Staff, Office of the Chief Financial Officer 
^hief Information Officer, OCIO 

= Chief Risk Officer, Office of the Chief Financial Officer 




Report Number: OIO-l 0-2-26-OTR 
FINAL REPORT 



Audit of Internal Controls Over Undelivered Mail and Address Changes 

TABLE OF CONTENTS 

EXECUTIVE SUMMARY .. ;ryi.. : 

OVERVIEW. > 

. CONCLUSION.... , . . : i 

' ' SUMMARY OF RECOMMENDATIONS AND MANAGEMENT ACTIONS... , . . . . . . f . i 

INTRODUCTION 

BACKGROUND ,/. . . . ; ., ; . .; , : .7 1 

:•; , OBJECTIVES, SCOPE, AND METHODOLOGY ..... , . 2 , 

FINDINGS AND RECOMMENDATIONS V'-''--- ■ 

FINDING 1 : TAXPAYER MAIL SUPPRESSION 4 

FINDING 2: . DELIVERY OF MAIL TO TAXPAYERS. 6 

FINDING 3: - 'BEST KNOWN" TAXPAYERS' ADDRESSES ..... ..10 

FINDING 4: CERTAIN OTR EMPLOYEES ARE ABLE TO UPDATE THEIR 

. OWN ADDRESSES IN ITS 12 

FINDING 5: , ITS DATA INTEGRITY REQUIRES IMPROVEMENT. .........14 

EXHIBITS 

EXHIBIT 1: SUMMARY OF POTENTIAL BENEFITS FROM AUDIT. 16 : 

EXHIBIT 2: AGENCY RESPONSE , 1; 17 



Report Number: 010-10-2-26-OTR 
FINAL REPORT 



Executive Summary 



OVERVIEW V::::' OV:V-:;s V-^YXr- \ 

This report summarizes our audit of the Office of Tax and Revenue's (OTR) process of handling: 
undelivered mail and address changes for individual and business tax entities. The Office of : 
Integrity and Oversight (010) conducted this, audit as part of its continuous audit coverage" of the 
OTR's operations. ; . 

The primary objectives of our audit were .to determine whether: (1) effective internal controls, are 
in place for processing. undelivered mail ■■•for all OTR functional offices; and (2) effective internal . 
controls are in place to provide reasonable . assurance that the address change process is freedom y 
errors or fraud. ; 

010 issued a management alert specifically for the process of handling undelivered mail by the. 
Real Property Tax Administration (RPTA). Management Alert Number MAR 2-26-OTR was : 
issued to OTR on February. 2, 2011 and identified the lack of an address, cleaning process" oh. 
RPTA's mailing database;- 010 provided four recommendations to address 1 the weaknesses arid,' 
help improve the administration's attempts to reduce undelivered mail. - ! ; • 

CONCLUSION 

010 identified five internal control issues in its review of the OTR's undelivered mail and 
address change process for individual and business tax entities, as follows: r v . 7 " : ■ 

1. Taxpayer mail suppression is not reviewed. 

2. Systemic weaknesses in the Integrated Tax System (ITS) hinder the delivery of mail to 
taxpayers. 

3. "Best Known" taxpayer addresses are not always used. 

4. Certain OTR employees are able to update their own addresses in ITS. 

5. ITS data integrity requires improvement. 

The above mentioned internal control weaknesses were caused by: (i) a lack of management 
oversight and analysis; (ii) an over reliance on ITS to automatically select the right mailing 
address and deal with mail suppressions; and (iii) lack of data integrity in the mailing address 
fields. 

SUMMARY OF RECOMMENDATIONS AND MANAGEMENT ACTIONS 

This report contains eleven (11) recommendations which address the findings identified during 
the audit. Four recommendations are directed to the Deputy Chief Financial Officer, Office of 
Tax and Revenue (DCFO, OTR) and include (1) development of policies and procedures for 
reviewing mail suppressions; and (2) requiring the Returns Processing Administration (RPA), 
Customer Services Administration (CSA), and Compliance Administration (CA) management to 
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conduct regular quality control reviews on ITS data integrity, including tax payers' primary and 
mailing addresses. : : : : ■ . 

We also addressed seven recommendations jointly.to the DCFO, OTR and the Chief Information 
Officer's (GIO Is) Tax Systems: Group (TSG). These recommendations center on: (l) ireviewing 
the ITS mailing hierarchy tables to ensure that OTR has-' the correct and up-to-date taxpayers' 
mailing addresses in the ITS database; and (2) reviewing the ITS mailing program to ensnre.that 
it generates the correct addresses on the outgoing mailing-labels. :.\ - ■ 

MANAGEMENT RESPONSE AND OIO COMMENTS ^^-Q^^-M^s 

As noted in the OTR response, management has generally concurred with- OIO's 
recommendations and has implemented or plans to implement corrective actions detailed in the 
attached document below. We find OTR's corrective actions to be responsive : to . our 
; recommendations. The full text of the OTR's response is included at Exhibit.2.. . ■ : , : . ,: j ' r, ; , 
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BACKGROUND 



the Office of Tax and Revenue is responsible for generating approximately one million or. 
rndrfe business notices and/oi; bills on a yearly basis (OTR generated 1,01:0,699 notices/bills . 
in 2009). Of the mail sent, OTR receives approximately 53,000 pieces of returned mail per- 
year on a five-year average basis (for FY 2009, it was 55,688 pieces). The Real Property -Tax ■ 
Administration (RPTA) accounted for 70% or 37,000 pieces of the returned mail received on. 
a^ five-year average basis. The next largest portion of undelivered mail (29% or 15,000 
pieces) was for the Compliance Administration, and the remaining portion (1% or 1,000 
pieces) was for Customer Service Administration. v . . 

• Undelivered mail is obtained ^ from the US Postal Service (USPS) through the District's.- 

■Department of Real Estate 'Services, and the Office of the Chief Financial Officer (OCFO). Office 
/ of Management and Administration Logistic 8i Support Division, and delivered -to OTR Returns ; 
:: Processing Administration (RPA) Receipts and Control Unit for processing.. The processing of 

undelivered, mail involves the sub-tasks of counting, sorting, cutting, delivering (to other units .of '■. 

OTR), and reporting (the number of undelivered mail processed daily and accumulated . .and: 

reported on a calendar year basis). 

We understand that there is no general OTR statistics available on why mail is undelivered, but a 
- study done by RPTA for the period August 23 through October 1, 2010 revealed that about 8% of 
the returned mail were shown with forwarding address or corrected address on the USPS returned 
mail labels, 43% of the returned mail was without forwarding address and have a USPS ■■ 
"undelivered" label although the address matches the address on the RPTA bill, and 40% of the 
returned mail was without a forwarding address and have a USPS "undelivered" label that has a 
mailing address that does not match the RPTA bill. 

When mail is returned by the post office, OTR records the mail as returned using the "mail 
suppression" feature in ITS, so that in the future, mail is not sent to the same incorrect address. 
When a new address is provided by the USPS, OTR updates the ITS profile window with the 
new mailing address and resends the notice (Collection Division written procedure). 

The taxpayer's address information is stored in a relational DB 2 table in ITS. The taxpayer's 
address change is data captured from returns using a "change of address" bubble on the paper 
form, or via a written change of address. The "change of address" bubble was removed in 
TY2007 from all forms, and data capture of all address information was requested by the Returns 
Processing Administration (RPA). New ITS client taxpayers information, including the address, 
is data captured, and a new profile is created in ITS. 

To ensure OTR is mailing notices and/or bills to the updated and current addresses, OTR has a 
memorandum agreement with the U.S. Internal Revenue Services (IRS) where OTR, on a regular 
basis, requests the IRS to provide OTR with the IRS Taxpayer Address Request (TAR) Tickler 
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File for address change data. The program updates addresses in ITS- where' the taxpayer's 
address has not updated in the last 18 months in the ITS mailing address database/However, this 
address cleaning process is only applied for individual income tax types mailing addresses and 
we understand that as of March 1Q, 2009,- the. TAR process does not release 'suppression for 
bills/notices. Once the ITS mailing address update is done, an exception- report is produced 
; showing abnormal mailing: addresses; -such ..is foreign addresses, or addresses ; with no 
r : apartment/cdndo ' lumbers. • The Gojnpliance:':-Adrmnistration would review the exceptions 
visually; however; they would make no changes to the system because to' change the file would 
require third-party (e.g., taxpayer) confirmation of the actual mailing address change. - : 

On February 2, 2011, we issued our management alert on Lack of Address Cleaning Process 'on ■ 
Real Property Tax Administration Mailing Database at the Office of Tax and Revenue (Report 
No. MAR 10-2-26-OTR). , , ..... ' . 

OBJECTIVES, SCOPE, AND METHODOLOGY M^-^pS:^^^^ 
The primary objectives of our audit were to determine whether: ; ' ; : 

1. Effective internal controls are in place for processing undelivered mail for all OTR ' 
' functional offices; and • 



2. Effective internal controls are in.place to provide reasonable assurance that the address ' 
change process is free from errors or fraud. 

The audit included the examination and testing of OTR undelivered mail and related- 
documentation during the period October 14, 2010 through April 25, 201 1. 

To accomplish our objectives, we obtained written procedures of processing undelivered from 
various administrations of OTR, interviewed the relevant officers who dealt with undelivered 
mails on day-to-day basis. 

We obtained a list of ITS suppressions with accounts receivables (as of January 7, 2011) and 
performed test work on selected suppressed taxpayers. We performed testwork on samples of 
undelivered certified mail issued by the OTR Compliance Administration Collections Unit to 
determine: (i) USPS explanation for the undelivered certified mail; (ii) whether the ITS has a 
newer address than the one used for the certified mail. 

In addition, we performed testing on matched addresses derived from a comparison of OTR 
Employees addresses and ITS Tax Payer Entities addresses changed by OTR employees (ITS 
data warehouse query as of April 13, 2011) to determine whether there are valid reasons for the 
matched addresses. 
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We conducted : this . performance audit , in. accordance with generally accepted government, 
auditing standards.. Those standards require Aat^we plan and perform, the audit , to obtain 
sufficient, appropriate evidence to provide . a. reasonable basis for our findings and conclusions 
based on our aiKMtg^jective& Pi We believe feat the., evidence obtained provides a reasonable basis, 
for our. findings and conclusions based on our audit objectives. . .■, : , f ;. v: ... 3 
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SYNOPSIS: ' ' ■ ' ' v '^ ; ■ ■ ■ :;: "' v - ; 

010 obtained a report of suppressed mail with accounts receivable and found 4,063 line items 
of suppressed mail with' an accounts receivable value of $10,057,616.90 as of January- 7 2011 ^ 
These mail suppressions were done during the period of 2005 to 2008. Our examination : f the 
electronic supporting documentation of the mail return suppression with accounts 
receivable revealed that the validity of the mail return suppressions and the bona fide existence 
and collectability of the related accounts receivable are in doubt as they are old and may have 
been overtaken by recent events. This issue was also identified in the meeting notes of ITS 
Modernization Specification interview with the Collection Managers, dated September 30 
2009 which noted, "once a suppression has -been initiated,, no one turned it off (i e a notice 
could be suppressed in ITS because of it, was undelivered, and it would stay suppressed even- 
though the taxpayer submitted a new return with a new address). Our audit revealed this 
condition still exists. 

DISCUSSION: 

The OTR has the ability to suppress mail to taxpayers that has been returned or undelivered 
When an entity or tax period is suppressed, further correspondence to the taxpayer is not ■ 
generated until the suppression is manually released by an employee. OIO reviewed a sample ' 
of 60 entities that were listed with suppressed mail associated with accounts receivable OIO 
noted 34 entities (57%) out of the 60 reviewed, were exceptions that should be' reviewed to 
ensure that the reasons for the mail return suppression are still valid, and that the related 
accounts receivable existence are still .bona fide and collectible. Specifically we noted the 
following: ' 

a) 20 entities (33%) of the 60 sampled had evidence of subsequent return submissions 
and/or payments; therefore, the accounts receivables and the mail return suppressions 
should be reviewed. 

b) 7 entities (12%) of the 60 sampled have supporting documentation that show the OTR 
is m the process of settling with the taxpayers, or the receivable is being written off. 

c) 7 entities (12%) of the 60 sampled have receivables that are more than 10 years old 
since the related tax assessment noted in ITS. These accounts receivables may not be 
collectible as they already exceed the statute of limitations. 

This issue may be attributed to the fact that mail suppressions are not systemically released 
upon receipt of new information and OTR does not perform a routine review of suppressed 
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RECOMMENDATION: 

1 . The DCFO, OTR direct the Compliance and Customer Service Administrations to: 
remove the unnecessary mail suppressions by the following actions: 

(a) Request the CIO/TSG to produce a report of ITS mail suppression with accounts 

.. receivables, (by tax payer entities), for review by the Compliance Administration y 
... and ITS mail suppression (by tax entities) for review by the Customer Service 
. Administration. '. ■ • . , 

(b) Direct the. administrations to systematically review the reports to determine: (a). ; 
• whether the mail suppression reason is still valid; (b) whether the accounts 

receivable is still collectible. Based on these results, suppressions should be 
removed as necessary. . . ; ■ . 

: MANAGEMENT RESPONSES AND 010 COMMENTS , .. ' -V ' \\ ■; 

Management Response (Recommendation 1) 



OTR will ask the CIO/TSG to produce reports of ITS mail suppressions with accounts 
receivable (by taxpayer entities) and ITS mail suppressions (by tax entities) for review by the 
respective administrations. They will be directed to determine the validity of the suppressions, 
and based on those determinations make, the necessary adjustments. It is anticipated that the 
reviews will begin in February and will take several months to accomplish without disrupting 
the work requirements during the filing season. We would anticipate a catch up date for 
reviews of June 30, 2012. 

010 Comment 

OTR planned corrective action is responsive and meets the intent of the recommendation, when 
fully implemented. 
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FINDING 2: DELIVERY OF MAIL TO TAXPAYERS 



SYNOPSIS: ■ ' ■ ' A . 

■ We-foUnff deficiencies in the address' update program and data integrity that hinder the ability 
to provide timely correspondence to taxpayers-. 

DISCUSSION: 

The OTR does not maintain statistics on why mail is undeliverable to taxpayers To gain an 
■understanding of why mail is returned to the OTR, OIO performed a walkthrough of the. 
.returned. mail process in. Compliance, performed a test of manual, address changes-. arid 
reviewed policies and procedures. Our. testing revealed the following deficiencies: - : • 

1 . ITS Taxpayer Address Update Process Is Not Functioning Properly ' 

Our test work found that USPS is unable to deliver the certified notices generated by ITS 
— mailing program because the mailing addresses generated by ITS were derived from 
outdated information. This can be attributed to the fact that the ITS program Wmj^L 
(new address from current TY returns) only updates the mailing address as it wkssetTp 
= in' the mailing program hierarchical table' and does not update taxpayer's -Driman 
addresses as is done wheraheaddress is updated by OTR personnel (TP info); IjBjjjl 
(TSC) program; or the ^Byconversion) program. However, the mailing program 
sometimes will use the primary address to generate mailing labels. We also noted 
undelivered mail due to bad address because ITS presumes that the taxpayer's tax return 
for the following tax year is equivalent to notifying OTR for his/her new address - even 
if the taxpayer made minor changes such as omitting the apartment number in the current 
tax return (the omission should have been noted and corrected when the RPA Code and 
Edit Unit Tax Examiner reviews the tax return during the scanning process). ■• 

A sound business administrative practice would require that the ITS program that updates 
the new address from a current tax year return should properly update the Taxpayer's 
primary and mailing addresses where the current tax return capture the correct and more 
up-to-date information about the taxpayer address. 

2. Blank Address Field in ITS 

Our ITS address change query yielded 2,467 tax entities with blank address fields (i e 
2% of the total population of 110,203 records). Further investigation of these blank 
address fields indicated the blank addresses were caused by "manual updates" done when 
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OTR employees, adding "related party" information in Tax Administration. System.. (TAS) 
did not complete the process to fill the profile. In other words, the employees .canceled 
.. : .out - of 'the next window (address information)- that appears to complete the ^profile. 
Discussion with the Customer Service Administration personnel revealed that some of 
■ the employees are not aware that the completion of the profile is mandatory. ' ■ •. 

Tne procedures for adding "related party" information as stated in the ITS; help . module 
require that the address detail . information : b&. completed when the "Address' Detail • 
Window" opens. Related party functionality was. created in order to record a relationship 
for an OTR client. This was primarily done in response to the users' request to have the 
related party receive copies of any correspondence issued from OTR as a copy recipient 
(e.g., taxpayer's attorney). 

3. IRS TAR Address Change Update Pwcess.Not Functioning Properly : : . . . , . , ; . 

. . 0ncc the Taxpayer Address Request (TA^); update is done, an exception report is., 
produced showing abnormal mailing addresses' such as foreign addresses, or addresses ; 
. wi $ J 10 apartment/condo numbers. We understand that the Compliance Administration ■'. 
reviews the exceptions visually; however, they do not make changes to the system- 
because to. change the file would require third-party (e.g., taxpayer) confirmation of the' 
■ actual mailing -address change. . .... ... -/=. ■ .-. 

Exception reports should be reviewed on a regular, consistent, and cost effective basis by 
• the relevant users. -.. 

RECOMMENDATIONS: 

The DCFO, OTR and the CIO jointly take action to: . 

2. Review the ITS mailing program hierarchical table that updates new address from 
current tax year (TY) returns to ensure that the program updates the taxpayer's 
primary and mailing addresses where the current tax return captures the correct 
and more up-to-date information about the tax payer address so that ITS generates 
correct and proper USPS mailing labels for OTR outgoing mail. 

3. Develop and maintain statistics on how many pieces of returned mail are 
processed and resolved (i.e., the release of mail return suppression) by OTR on a 
regular basis to timely identify problems with the mailing programs. 

4. Produce a report of taxpayers with blank address fields on a regular basis. 

5. Direct the appropriate OTR administration (Customer Services/Return 
Processing) to review the report, and to determine: (a) whether those taxpayers 
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..address field .should.be blank, or perform the necessary corrections; (b) conduct 
; training classes for those OTR employees who. are consistently updating 
. taxpayers' related. party address fields to "blanks", • • 

6. '.Amend. ITS taxpayer's address fields manual "related party update" program, so ^ 
that "blanks" are not allowed, unless it is specifically end-dated, suppressed, and 
. explained;: A ;cost benefit analysis sho.^ prior to any amendments. " 

7.. ; Review all TAR exceptions reports promptly, and. update "best known" taxpayer 
. ., addresses. ; , ^, 

MANAGEMENT RESPONSES AND 010 COMMENTS 
Management Response (Recommendation 2) 

OTR. has asked CIOZTSG to review the .. mailing . program hierarchical table- to : .'determin.e ^ if it 
updates the new address from current tax year-(TY)- returns to. ensure the program updates ; the 
taxpayer's primary address. If it is hot making the corrections, we will. ask. TS.G for ..a level. " 
of effort to make corrections and will request changes as appropriate. This' review should be" 
completed by January 2012. 

OIO Comment 

OTR planned corrective action is responsive and meets the intent of the recommendation, when 
fully implemented. 

Management Response (Recommendation 3) 

OTR has developed a chart to track the pieces of returned mail and how they are processed 
and resolved. We will attempt to identify root causes of the returned mail. This will be an 
ongoing process. 

OIO Comment 

OTR planned corrective action is responsive and meets the intent of the recommendation. 
Management Response (Recommendation 4) 

We have asked TSG to develop a report that is produced monthly to identify the taxpayer 
accounts with blank address fields. We will attempt to identify the cause for the blank fields 
and, if possible, the area responsible for their generation. This will be an ongoing process. 
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010 Comment . a:- ; ;. v.. v - ; , , . 

::OTR planned corrective action is responsive and meets the intent of the recommendation. ■ : . 

Management Response (Recommendation 5) V 

OTR will direct all appropriate, administrations to review the report and determine if the blank. 
' field resulted from their actions and if the: blank field .is appropriate- If - a blank field is- 
appropriate, we will try to .determine why the employee thought it should be blank, and we will 
hold training sessions to re-educate the employees on the proper entry procedures-. We 
expect to complete, this by June of 2012. : . 

010 Comment 

OTR planned corrective: action: is responsive and meefs-thedntent of the recommendation,: when ; "< ; ■ 
fully implemented. ... • • • , : , r ; - " : - ; : , :l • . : 

Management Response (Recommendation 6) 

OTR will have CIO/TSG do a cost benefit analysis and level of effort study of the issue and 
determine if it will be prudent to make any modifications to the system. We will make the 
study and our decision known to 010 by June 30, 2012. 



010 Comment 

OTR planned -corrective action is responsive and meets the intent of the recommendation, when 
fully implemented. 

Management Response (Recommendation 7) 

. We will have all TAR exceptions reports reviewed timely and the taxpayer addresses updated 
to the "best known" address. 

010 Comment 

OTR planned corrective action is responsive and meets the intent of the recommendation. 
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synopsis: . - r\ *' ^ --- : ,; rr • 

010 found that the "Best Known" address was not always used to mail notices to taxpayers, 
' which delayed the timely correspondence and collection of taxpayer liability and increase 
postage costs due to the need to resend mail multiple times. ;■- : 

DISCUSSION: , . . .^-'^v:^- 

The ITS is designed to. allow a taxpayer, to have multiple addresses designated as primary,' 
mailing and locatidii addresses. For example, an individual income taxpayer may have a • = ' 
primary address and a mailing address where! they want to receive their mail; and a business 
may have a primary address and a separate mailing address for each tax type such as business 
franchise, sales and use, and withholding taxes, as well as location addresses. All of these 
addresses are stored in a relational database. While it is acceptable to have multiple addresses ■ 
to fit business needs, we found that the incorrect address was used to send notices to taxpayers. 

010 performed a walk-through of certified mail returned to the Compliance Administration. 
Of the 84 pieces of returned mail reviewed (61. undelivered collections notices generated by 
ITS, and 13 undelivered audit notices generated manually by the tax auditors), we found that- : 
USPS is unable to deliver the certified notices generated by the ITS mailing program because 
the wrong mailing address was used. In the notices generated manually, we found tax auditors 
sent notices to the taxpayers' old addresses, instead of the available new addresses shown in 
ITS taxpayers' profiles. We also found that taxpayers' new addresses are being recorded in 
ITS Note fields; however, the taxpayers ad'dress profile is not updated. In one instance, we 
found a deceased taxpayer was sent a notice to the old address while there is a Probate Court 
Certificate noted in ITS . 

Quality control should be performed on notices being sent out to the "Best Known" taxpayers' 
addresses where the taxpayers have multiple mailing addresses, and other special 
circumstances that are not built into the ITS mailing program logic. 
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RECOMMENDATIONS : 

The DCFO, OTR direct the Compliance Administration to: '. - . :•, . 

8, Perform quality control review (on a trending/sampling basis) on returned collection 
and/or audit notices to ensure that "best known" addresses are used for future mailings 

... to those. taxpayers who have special addresses that are not designed into the TTS' 
• mailing program, logic, - ... ....... .v,. ,. , ,. v : y ;. 

9. Train employees to select the "best known" address when mailing manual certified .mail 
and notices., 

MANAGEMENT RESPONSES AND 010 COMMENTS 
Management Response (Recommendation 8) 

We will perform a quality control review of mail returned with addresses that do not Conform 
to. the ITS bailing program logic. We will determine why they were released for mailing and/ 
take the necessary steps to stop them from 1 being mailed in the future whenever possible.. This 
will be an ongoing process. • 

010 Comment 

OTR planned corrective action is responsive and meets the intent of the recommendation. 
Management Response (Recommendation 9) 

OTR will issue a directive concerning the addresses of taxpayers and how and when' they 
need to be updated in the system. We will also train employees on methods of verifying the 
address on manually preparing items for mailing to reduce the volume of returned mail. This 
will be completed by January 3 1, 2012. 

010 Comment 

OTR planned corrective action is responsive and meets the intent of the recommendation, when 
fully implemented. ' - 
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FINDING 4: CERTAIN OTR EMPLOYEES ARE ABLE TO UPDATE THEIR 
OWN ADDRESSES IN ITS 



SYNOPSIS: 



ITS access security requires that each ITS user have & profile defining their security access 
priviliges to the system. OTR has implemented procedural and system changes to tighten the. 
ITS access security. However, the external auditor its FY 2010 Yellow Book General 
Information Technology findings noted that OTR fails -to consistenly restrict privileged:'; and 
- general user access to key financial applications in accordance with: employees Job 
• responsibilities and/or segregation of duties considerations. Our finding below disclosed that 
■ these conditions still. exist. . . ,, . ■ 

DISCUSSION: '* . .. • - . . ■ ■■. '.!",■:] 

Our test work on address changes (i.e., ITS data warehouse query as of April 13, 2011, on ITS 
Taxpayer Entities addresses changed by OTR employees) revealed that certain OTR employees 
: are able to update their own addresses in ITS: This is due/ to the fact that ITS access security 
profiles allow certain OTR employees to have ITS access and update capabilities on their own 
tax profiles. ■ . ; 

The application of sound segregation of duties requires that OTR employees have no access or 
update ability on their own tax entity profiles in ITS. ■ . 

RECOMMENDATION: 

The DCFO, OTR and the CIO jointly: 

10. Review and restrict the ITS access security profiles for its employees to ensure that no 
employees have ITS access or update capability on their own tax profiles (e.g., put them 
on restricted access list). 

MANAGEMENT RESPONSES AND OIO COMMENTS 
Management Response (Recommendation 10) 

OTR has already begun another review of employee access and security profiles. We have 
already restricted some additional employees from the ability to make changes in the system 
that would affect their accounts including the address field. Employees are placed in the 
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restricted access file. The number of OTR employees, with access, to the . restricted, accounts 
is limited. We will take a second look at the entire process to determine if further tightening of 
controls is possible. This will be completed by March 3,1, 2012.. . 

OIO Comment J •; . 

OTR planned, corrective action is.responsive and meets the intent of the recommendation, when, 
fully implemented. . 
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FINDING 5: ITS DATA INTEGRITY REQUIRES IMPROVEMENT 



SYNOPSIS: 



Data integrity is the cornerstone of the multi-users reliance on an Enterprise Resource Planning 
(ERP) application such as ITS. However, during our audit, we noted certain exceptions that 
raised the need for regular quality control reviews to be performed on ITS data integrity. : 

DISCUSSION: ' - 



Our walk-through testing revealed numerous instances of poor quality .of taxpayer's data 
integrity. Specifically, we noted the following: , • • 

•. Five instances where one taxpayer has multiple account profiles in ITS (i.e., when their 
scanned amended return was inserted to another account profile). Because the taxpayer 
has multiple account profile, we noted incidences where the taxpayer payments for one 
particular tax year were unapplied to the related tax liability. 

• Taxpayers with unapplied payments to their ITS account received notices to collect the 
outstanding debts, although they already paid. 

• One instance where a taxpayer living at the same location having two SSN's because 
the taxpayer's amended return was scanned and then manually edited with a different 
SSN. 

RECOMMENDATION: 

1 1 . The DCFO , OTR take action to improve the ITS data integrity by: 

(a) Requesting the TSG to produce a report of taxpayers with multiple account 
profiles in ITS on a regular basis. 

(b) Requesting the TSG to produce a report of taxpayers with multiple tax identities 
in ITS on a regular basis. 

. (c) Reviewing the reports, to determine whether those tax payers should have 
multiple account profiles, and/or multiple tax identities, and perform the 
necessary corrections. 
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MANAGEMENT RESPONSES AND 010 COMMENTS 

Management Response (Recommendation 11) ; , > . : : -, 

We will request the TSG to produce" the listed reports as suggested and will review, the 
results to determine if it is possible to make- the - number of corrections, -necessary. . If -the 
process, appears to be workable, OTR will have reports produced monthly or quarterly and- 
make the necessary .changes. If the reports are. voluminous, we will consult with 010 for- 
further suggestions. OTR is mindful that we are in the process of preparing to implement a 
new system and data cleanup will be an important part of the process. This request will be 
completed by December 31, 2011. " ; ' ' ; v • : 

010 Comment ; : ; 

OTR planned corrective action is responsive and meets the intent of the recommendation/ ■ ■ ■ ■:■ 
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.^ X hibit 1 : SUMMARY^ OF PQTE1VTI AL BENEFITS FROM AUDIT ' 



Recommendation 
Number 


Deputy Chief Financial 
Officer, Tax and 


Chief Information 


Description of Benefit 


Amount and 
Type of Benefit 


Agency 
Reported 
Estimated 
Completion , 
Date 


Status 1 •"• : 

,:■ • . 


l 


v 

X 




Improve OTR Mail Return 
Suppression Process. 


Improvement 
on Future 
. Revenue 

' Collection 
Internal Control 


6/30/2012' 


• Open 


. 2 


X 


X 


Improve. ITS Taxpayer 
Address Update process. 


lIlLCIIidl v^uiiLroi 


1 A3 1 /o n 1 o 

1/ 31/ZUl-Z : 


Open, 


3 


X 


X 


Improve ITS Taxpayer 
Address Update process. 


JUlLC/liiCtl V^UIILIUI 


ingoing 


Open 


A - 


X 


X 


Improve ITS Taxpayer - 
Address Update process. 




fin fT f~\ 1 Y*l CT 

wiigomg 


Open 


5 


X 


X 


Improve ITS Taxpayer 
Address Update process. 


Infernal (^nntrnl 

XXX LV^X XX CXI \ '\JlxLX \J1 


U/jU/ZrU 1 Z- 


Open 


6 


X 


X 


Improve ITS Taxpayer 

/-5lU.U.icSp J-^alaQaSe. 


Internal Control 


6/30/2012 


Open 


7 


X 


X 


Improve ITS TAR Address 
Change Update Process 


Internal Control 


Ongoing 


Open . 


8 


X 




Reduce Undelivered Mail 


Internal Control 


Ongoing 


Open 


9 


X 




Reduce Undelivered Mail 


Internal Control 


1/31/2012 


Open 


10 


X 


X 


Improve ITS Access 
Security Internal Control. 


Internal Control 


3/31/2012 


Open 


11 


X 




Improve ITS Taxpayer's 
Account Data Integrity. 


Internal Control 


12/31/2011 


Open 



This column provides the status of the recommendation as of the report date. For final reports "Open' means 
management and the OIO are in agreement on the action to be taken, but the action is not complete. "Closed" 
means that management advised that the action taken needed to correct the condition is complete. If a completion 
date was not provided the date of management's response was used. "Unresolved" means that management has 
neither agreed to take the recommended action nor proposed satisfactory alternative actions to correct the condition. 
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GOVERNMENT OF THE DISTRICT OF COLUMBIA 
OFFICE OF THE CHIEF FINANCIAL OFFICER 
OFFICE OF TAX AND REVENUE . 



•Slcphen M.'Cordi. 

Deputy Chief Fimmcia) Officer 



MEMORANDUM 



TO: 



FROM: 



DATE: 
SUNJECT: 




William J..DiVello, Executive Director 
Office of Integrity and Oversight 

deputy Chiefjlj 
QfijceoO'ax and Revenue 

, December 15, 2.0.1 1 

DRAFT REPORT on the Audit of Internal Controls over Undelivered Mail and 
Address Change Processes at the Office of Tax and revenue (Report Number 
OIQ: 10-2-26.QTR) 



The Office of Tax arid Revenue concurs with the findings of the Office of Integrity and Oversight 
concerning the five internal control issues concerning undelivered mail and address change 
processes lor individual and business tax entities. 

010 recommendation: 

1. The DCFO, OTR direct the Compliance and Customer Service Administrations to remove 
the unnecessary mail suppressions by the following actions: 

(a) Request the CJO/TSG to produce a report of ITS mail suppressions with accounts 
receivables (by taxpayer entities) for review by the Compliance Administration and ITS 
mail suppression ( by tax entities) for review by the Customer Service Administration. 

(b) Direct the administrations to systematically review the reports to determine: (a) whether 
the mail suppression reason is still valid: (b) whether the accounts receivable is still 
collectible. Based on these results, suppressions should be removed as necessary. 

Response: OTR will ask the ClO/TSG to produce reports of ITS mail suppressions with accounts 
receivable (by taxpayer entities) and ITS mail suppressions (by tax entities) for review by the 
respective administrations. They will be directed to determine the validity of the suppressions and 
based on those determinations make the necessary adjustments. It is anticipated that the reviews 
will begin in February and will lake several months to accomplish without disrupting the work 
requirements during the filing season. We would anticipate a catch up date for reviews of June 30 



1 101 4th Slreel, SW, Suiic 750 W, Washington, DC 20024 * Phone (i 

www.iaxpuyer.servicccemer.com 
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010: 1 0-2-26-OTR 

(UndeHverable Mail/Address Change Processes) 

December. .15, 20 11 

Page 2 ' ' ". ' 



2. Review the ITS mailing program hierarchical table that updates new addresses from 
current tax year (TV) returns to ensure that the program updates the taxpayers primary and 
mailing addresses where the current tax return captures the correct and more up-to-date 
information about the tax payer address so that ITS generates correct and proper USPS 
mailing labels for OTR outgoing mail. 

Response: OTR has asked; ClO/TSG lo review the mailing program hierarchical lable lo determine 
iritupclates the- iimv .address from current lax year (TY) returns to ensure the program- updates the 
taxpayer's primai^:iidcli'ess. If il is not making the corrections we will ask TSG for a level of effort 
.to make corrections and will request changes as appropriate. This review should be completed bv 
January ,2012. : ; . , 

3. Develop and maintain statistics on howmanypieces of returned mail arc processed and 
resolved (i.e., the release of. mail return, suppression) by OTR on a regular basis to timely 
identify problems with the mailing programs. 

Response: OTR has developed a chart to track the pieces of returned mail and how they are 1 : 
processed and resolved. We will attempt lo identify root causes of the returned mail. This will be 
an ongoing process. 

4. Produce a report of taxpayers with blank address fields on a regular basis. 

Response: We have asked TSG Lo develop a report thai is produced monthly to identify the 
taxpayer accounts with blank address fields. We will attempt to identify the cause for the blank 
fields and, if possible, the area responsible for their generation. This will be an ongoing process. 

5. Direct the appropriate OTR administration (Customer Services/Return Processing) to 
review the report, and to determine: (a) whether those taxpayers address fields should be 
blank, or perform the necessary corrections; (b) conduct training classes for those OTR 
employees who are consistently updating taxpayers' related party fields to "blanks". 

Respons.c: OTR will direct all appropriate administrations to review the report and determine if the 
blank field resulted from their actions and if the blank field is appropriate. If a blank field is 
appropriate, we will try lo determine why the employee thought it should be blank, and we will hold 
training sessions to re-educate the employees on the proper entry procedures. We expect to 
complete this by June of 2012. 
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010: 10-2-26-OTR 

'■(Unpleliyerable Mail/Address Change Processes) 
December 15,2011. 
Page 3 



■. ■ . ■ :6. Amend ITS taxpayer's .address fields manual "related parry update" program so that ; ' " 

^blanks" arc no! allowed, unless i^is : specifieaIiy endrdated, suppi^ssed, aiul explained. A cost 
benefit analysis should.be performed prior to any amendments. • 

y>:-< : Response: OTR will have C10/TSG do a cosl benefit analysis and level of effort study of the issue - % 
. .. .. / and determine if ii will be prudent to make any modifications lo the system. We will make the ' • 
/ ; ; . :^saidy.and.oui: clecisipn.known to OiO. by June 30. 2012; ... V - :: ' '' "■ ■ 

, .7. .Review all TAR exceptions. repprts^promptly. and update "best luiown" taxpayer addresses/ ; . : 

Response: We will have all. TAR exceptions reports reviewed timely and the taxpayer addresses • 
updated to the "best known" address. ■>■:■■■ 

8. Perform qualify control review (on. a trending/sampling basis) on returned collection 
and/or audit notices to ensure that "best knoivn" addresses are used for future mailings to 
those taxpayers who have special addresses that arc not designed into the ITS mailing* 3 

. ■ program logic. 

Response: We will perform a quality control review of mail returned with . 
coniform to the ITS mailing program logic. We will determine why they were released for mailing ' 
and take the necessary steps to stop them from being mailed This 
will be an ongoing process. 

9. Train employees. to select the "best known" address when mailing manual certified mail 
and notices. 

Response; OTR will issue a directive concerning the addresses of taxpayers and how and when 

they need to be updated in the system. We will also train employees on methods of verifying the 

address on manually preparing items for mailing to reduce the volume of returned mail. This will 

be completed by January 31. 2012. - . 

10. Review and restrict the ITS access security profiles for employees to ensure that no 
employees have ITS access or update capability on their own tax profiles (e.g., put them on 
restricted access list). 

Response: OTR has already begun another review of employee access and security profiles. We 
have already restricted some additional employees from the ability to make changes in the system 
that would affect their accounts including the address field. Employees are placed in the restricted 
access file. The number of OTR employees with access to the restricted accounts is limited. We 
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010: 10-2-26-OTR 

(Undeliverable Mail/Address Change Processes) 
December 15, 2011 
Page 4 



will take a second look, at the entire.processlo -determine if further tightening of controls is possible; •••• 
This . will l^e completed. by March 31, 2012, ' ■ ^ .. ' . 

The DOFO, OTR take notion to improve the ITS data integrity by: 

..■■.v (a) -Requesting m^^ ^ .■■ 
' .. • /.'ITS on a regular basis. . .. • . 

, : (b) Requesting the TSG to produce a report of taxpayers with multiple tax identities in ITS 
v " ; . on a -regular .basis. - , / • .. . : . . . 

(c) Reviewing the reports to determine whether those tax payers should have multiple 

account profiles,: and/or mtillipje .tax .identities, and perform the necessary corrections. . 

Response: We will request the TSG to produce the listed reports as suggested and will review the 
'results todetermine. i r.it is possible to make the number of corrections necessary If the process . 
appears to be workable,, OTR will have reports produced monthly or quarterly and make the 
necessary changes, if the reports are voluminous, -we will consult with 010 for further suggestions: "~ 
OTR is mindful that we are in the process of preparing to implement a new system and data cleanup - 
will be an important part of the process. This request will be completed by December 3 1, 201 1 . 

If you have any further questions, please contact Glen Graff, Director of Operations., at 442-6499. 



cc: 
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